lasdf1234 opened a new pull request, #13342: URL: https://github.com/apache/gravitino/pull/13342
## Summary - Reduce built-in IdP SHA3-512 password stretching from **100,000** to **10,000** iterations to lower Basic authentication verify latency. - Reject legacy `i=100000` PHC hashes on verify (no backward compatibility). - Update local authentication design doc and add a unit test for legacy iteration rejection. ## Why Each Basic-auth request verifies the password hash. At 100k iterations, verify takes about **~39 ms** on typical hardware; hashing dominates that cost. Cutting iterations to one tenth reduces verify time proportionally (local benchmark after this change: **~5.4 ms** per verify). ## User-facing change **Yes — breaking change for existing IdP users.** - New password hashes use `$sha3-512$i=10000$...`. - Stored hashes with `i=100000` are rejected; **users must reset passwords** after upgrade. ## Test plan - [x] `./gradlew :plugins:idp-basic:test --tests org.apache.gravitino.idp.basic.password.TestSha3512PasswordHasher -PskipITs` - [x] Manual benchmark: verify avg **~5.4 ms** at 10k iterations vs **~39 ms** at 100k (same machine) Fix: #13341 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
